Iptables

In Linux system administration and network security, iptables stands as an essential utility. It serves as the userspace

In Linux system administration and network security, iptables stands as an essential utility. It serves as the userspace interface to the kernel's Netfilter firewall framework, enabling administrators to inspect, process, forward, or drop network packets through a defined set of rules. This guide walks through the foundational concepts, structural components, and practical configurations needed to manage iptables effectively.

At the heart of iptables lies a clear hierarchical design. Grasping the relationship between tables and chains is fundamental to mastering the tool.

Tables: Functional Containers

Tables categorize rules by purpose. iptables includes four default tables:

  • filter: The most commonly used table. It handles packet filtering and determines whether packets are allowed to pass. It contains the INPUT, OUTPUT, and FORWARD chains.
  • nat: Dedicated to Network Address Translation, supporting tasks such as port forwarding, source NAT (SNAT), and destination NAT (DNAT).
  • mangle: Used to alter packet headers, for example by modifying TTL or Type of Service (TOS) fields.
  • raw: Intended for packets that should bypass connection tracking entirely.

Chains: Packet Traversal Paths

Chains represent the routes packets take through the firewall. Rules are attached to these chains, and the system evaluates them in order when a packet arrives:

  • PREROUTING: Processes packets immediately after they arrive, before routing decisions are made.
  • INPUT: Triggered when a packet is destined for the local host.
  • FORWARD: Applies to packets passing through the system to another destination.
  • OUTPUT: Handles packets generated locally and leaving the host.
  • POSTROUTING: Modifies packets just before they exit the firewall.

Command Syntax and Common Options

The general syntax for iptables follows this pattern:

iptables [-t table] command [chain] [matching criteria] [-j target]

Common operation flags include:

  • -A: Appends a rule to the end of a specified chain.
  • -I: Inserts a rule at the top of a specified chain.
  • -D: Deletes a specific rule from a chain.
  • -L: Lists rules in a chain.
  • -F: Flushes all rules from a chain.
  • -P: Sets the default policy for a chain.

Standard target actions are:

  • ACCEPT: Permits the packet to proceed.
  • DROP: Silently discards the packet without any response.
  • REJECT: Blocks the packet and sends a rejection notice back to the sender.
  • LOG: Records packet details to the system log and continues processing subsequent rules.

Practical Configuration Scenarios

The following examples demonstrate common firewall tasks on a Linux server.

Inspecting Current Rules

Before making changes, review the existing ruleset:

iptables -L -n -v

The -n flag displays IP addresses and ports numerically, while -v provides verbose output, including packet and byte counters.

Establishing a Baseline Security Policy

A typical server strategy defaults to denying inbound traffic, permitting outbound traffic, and selectively allowing essential services such as SSH.

First, set the default policies:

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

Next, permit traffic associated with already-established connections. This prevents active sessions from being dropped:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Allow loopback interface traffic:

iptables -A INPUT -i lo -j ACCEPT

Open SSH on port 22:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Enable HTTP and HTTPS:

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Blocking and Unblocking IP Addresses

To block a malicious source—for example, 192.168.1.100:

iptables -A INPUT -s 192.168.1.100 -j DROP

To lift the block, replace -A with -D:

iptables -D INPUT -s 192.168.1.100 -j DROP

Saving Rules for Persistence

Rules created through the command line are ephemeral; they disappear after a reboot. To make them permanent, they must be saved to the appropriate configuration mechanism.

On Debian or Ubuntu systems, install iptables-persistent:

apt-get install iptables-persistent
netfilter-persistent save

On CentOS or RHEL systems:

service iptables save

Alternatively, export the ruleset directly:

iptables-save > /etc/sysconfig/iptables

Conclusion

iptables remains a cornerstone of Linux network operations. Although modern distributions increasingly adopt nftables or firewalld as frontends, the underlying logic remains closely tied to iptables. Understanding the table-chain-target model not only helps in building secure host firewalls but also deepens insight into the Linux networking stack. When configuring production environments, exercise caution—an overly restrictive INPUT policy can accidentally lock you out of your own SSH session.